Computer-technical examination is a study of the technical properties of digital equipment (computers, storage devices, mobile phones, etc.) and software in order to obtain factual data relating to the circumstances of the crime or the subject of a civil lawsuit. Examination allows you to identify significant signs of a crime (incident) and create a comprehensive evidence base by examining the information.
The tasks to be solved within the framework of computer service technician examination are:
establishing the type (type, brand), properties of the hardware, as well as its technical and functional characteristics;
establishment of the actual condition and serviceability of the hardware;
detection and study of functional properties, as well as software settings, time of its installation;
identification of the required information, establishment of its properties and type of display in the computer system;
recovery of deleted and encrypted information on various types of media;
detection of signs of malware activity;
detection of traces of activity on the Internet, the content of e-mail, the history of messaging in communication programs and more.
is on electronic drives.
Objects of computer technical examination are both hardware (computer system units and their components, servers, laptops, hard drives, flash drives, modems, routers, etc.) and software products (computer programs, databases, etc.).